Vulnerabilities

TI-2016-08789 CVE-2016-10751 · GHSA-rx8m-6wvh-3j5h

osClass 3.6.1 allows oc-admin/plugins.php Directory Traversal via the plugin parameter.

LOW 37

osClass 3.6.1 allows oc-admin/plugins.php Directory Traversal via the plugin parameter.

CVSS 3.0HIGH 7.2 Network High privileges No interaction EPSS 0.02814 Published 2019-05-24 No fix listed CWE-22

TI-2018-10390 CVE-2018-14481 · GHSA-x2fh-fcfp-ww8m

Osclass 3.7.4 has XSS via the query string to index.php, a different vulnerability than CVE-2014-6280.

LOW 29

Osclass 3.7.4 has XSS via the query string to index.php, a different vulnerability than CVE-2014-6280.

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.01081 Published 2019-01-03 No fix listed CWE-79

TI-2014-06702 CVE-2014-8085 · GHSA-c4jg-9g74-c7p6

Unrestricted file upload vulnerability in the CWebContact::doModel method in…

LOW 35

Unrestricted file upload vulnerability in the CWebContact::doModel method in oc-includes/osclass/controller/contact.php in OSClass before 3.4.3 allows remote attackers to execute arbitrary PHP code by uploading a file wi…

CVSS 2.0MEDIUM 6.8 Network No auth Interaction — EPSS 0.02514 Published 2015-01-05 No fix listed

TI-2014-06701 CVE-2014-8084 · GHSA-x8hq-gmcw-28cp

Directory traversal vulnerability in oc-includes/osclass/controller/ajax.php in OSClass…

LOW 39

Directory traversal vulnerability in oc-includes/osclass/controller/ajax.php in OSClass before 3.4.3 allows remote attackers to include and execute arbitrary local files via a ..

CVSS 2.0HIGH 7.5 Network No auth Interaction — EPSS 0.03249 Published 2015-01-05 No fix listed CWE-22

TI-2014-06700 CVE-2014-8083 · GHSA-259r-6293-4g55

SQL injection vulnerability in the Search::setJsonAlert method in OSClass before 3.4.3…

LOW 37

SQL injection vulnerability in the Search::setJsonAlert method in OSClass before 3.4.3 allows remote attackers to execute arbitrary SQL commands via the alert parameter in a search alert subscription action.

CVSS 2.0HIGH 7.5 Network No auth Interaction — EPSS 0.02356 Published 2015-01-05 No fix listed CWE-89

TI-2014-05186 CVE-2014-6308 · GHSA-6m3m-wc9x-2j74

Directory traversal vulnerability in OSClass before 3.4.2 allows remote attackers to read…

MEDIUM 43

Directory traversal vulnerability in OSClass before 3.4.2 allows remote attackers to read arbitrary files via a ..

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.2226 Published 2014-10-20 No fix listed CWE-22

TI-2014-05165 CVE-2014-6280 · GHSA-73wq-fqgr-pmvw

Multiple cross-site scripting (XSS) vulnerabilities in OSClass before 3.4.2 allow remote…

LOW 24

Multiple cross-site scripting (XSS) vulnerabilities in OSClass before 3.4.2 allow remote attackers to inject arbitrary web script or HTML via the (1) action or (2) nsextt parameter to oc-admin/index.php or the (3) nsextt…

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.01892 Published 2014-10-20 No fix listed CWE-79

TI-2012-04353 CVE-2012-5163 · GHSA-8cv6-5hqj-rcj2

Cross-site scripting (XSS) vulnerability in oc-admin/ajax/ajax.php in OSClass before…

LOW 24

Cross-site scripting (XSS) vulnerability in oc-admin/ajax/ajax.php in OSClass before 2.3.5 allows remote attackers to inject arbitrary web script or HTML via the id parameter in an enable_category action to index.php.

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.01792 Published 2012-09-26 No fix listed CWE-79

TI-2012-04352 CVE-2012-5162 · GHSA-h4fh-7rp6-262g

Multiple SQL injection vulnerabilities in oc-admin/ajax/ajax.php in OSClass before 2.3.5…

LOW 31

Multiple SQL injection vulnerabilities in oc-admin/ajax/ajax.php in OSClass before 2.3.5 allow remote attackers to execute arbitrary SQL commands via the id parameter in a (1) edit_category_post or (2) enable_category ac…

CVSS 2.0MEDIUM 6.5 Network Low privileges Interaction — EPSS 0.0104 Published 2012-09-26 No fix listed CWE-89

TI-2012-00887 CVE-2012-0973 · GHSA-x9v8-c559-cwwm

Multiple SQL injection vulnerabilities in OSClass before 2.3.5 allow remote attackers to…

LOW 37

Multiple SQL injection vulnerabilities in OSClass before 2.3.5 allow remote attackers to execute arbitrary SQL commands via the sCategory parameter to index.php, which is not properly handled by the (1) osc_search_catego…

CVSS 2.0HIGH 7.5 Network No auth Interaction — EPSS 0.02406 Published 2012-09-25 No fix listed CWE-89

Vulnerabilities

Filters